Tuesday, May 29, 2018

TDoA northern Europe

Here is a Link-11 SLEW signal (see, e.g., here) picked up on 5 KiwiSDRs in Northern Europe and in Iceland which seems to come from the region around Andenes, Norway:
TDoA cross-correlations
TDoA maps
Thanks to all KiwiSDR owners who enabled GNSS reception!

The plot below shows abs(z) in frames of 1600/12000 seconds:

Thursday, May 24, 2018

STANAG 4285 survey

Perhaps not surprisingly, the frame markers described in this blog post were also found in STANAG 4285 the bit streams. The table below summarizes a 30 min scan of STANAG 4285 signals using the excellent KiwiSDR @T4FM. The bitstreams were obtained using this code.

6800 - 13500 kHz, 20180522T0945-1015Z, T4FM KiwiSDR, STANAG 4285 600L and 1200L.
format count remarks
(1) 14 7-bit frames delimited by F1, see here
(3) 14 7-bit frames delimited by F4, see here
CARB 5 ITA1 coded Channel Availability and Receipt Broadcast messages, see Antonio's blog
1536-bit ACF 3 see Antonio's blog
15-bit ACF 1 see Antonio's blog

Monday, May 21, 2018


This post is for people interested in ham band intruders. In this case it is a STANAG4285 signal on 5361.8 kHz. The frequency shown on the plots is the center frequency of the modulation (5363.6 kHz = 5361.8 kHz + 1.8 kHz).

For the TDoA analysis, IQ recordings with GNSS time stamps from four KiwiSDRs located in Europe were used. The cross correlations below show at least two different modes of propagation:

Only the points marked in red which were selected by hand are used for the time-difference of arrival analysis. The location of this signal likely is Frederikshavn, Denmark: (see also this UDXF post)

Let's now have a closer look at the signals themselves: the modulation is STANAG 4285 with 600 bps (PSK after descrambling) using the long interleaver. In the figures below one can see the HF channel response in taps of the adaptive the channel equalization filter. The bit stream is encrypted and consists of 7-bit frames marked by a LFSR sequence (format F1 in this blog post).
STANAG 4285: top - descrambled symbols; bottom: decision-feedback channel equalizer taps
STANAG 4285: top - descrambled symbols; bottom: decision-feedback channel equalizer taps
STANAG 4285: top - descrambled symbols; bottom: decision-feedback channel equalizer taps
STANAG 4285: top - descrambled symbols; bottom: decision-feedback channel equalizer taps
The code used for this analysis can be found on GitHub: https://github.com/hcab14/TDoA, and https://github.com/hcab14/signal-analysis.

This is how the cross-correlations looked a few hours later and it serves to illustrate that the ionosphere is far from being a perfect mirror:

Sunday, May 13, 2018

Some interesting FSK signals found on HF

The following FSK modulated signals were picked up recently using KiwiSDRs located at DF0KL and at Newport,OR using kiwirecorder.py

All signals use a format similar, but not identical, to STANAG 5065 where frames are delimited by LFSR-generated pseudo-random sequences. These formats may also be related to the patent EP2220799A2.

KiwiSDR location Frequency* (kHz) Date UTC Shift (Hz) Baud Format
Newport 4905.0 4/2/18 08:49 850 50 (3)
Newport 4985.0 4/2/18 08:47 850 50 (1)
DF0KL 6376.3 4/2/18 08:32 850 50 (2)
DF0KL 13419.8 4/5/18 14:46 850 50 (2)
DF0KL 16123 4/2/18 10:35 850 50 (1)
Newport 7455.0 4/2/18 08:56 850 50 (1)
DF0KL 8518.8 4/2/18 08:35 850 50 (2)
*center frequency between mark and shift

The recorded IQ data streams were demodulated using a combination of octave and C++ code, see https://github.com/hcab14/signal-analysis

For testing if a given bit sequence is generated by a LFSR, a simple method was used which is described, e.g., in this thesis. This method uses Gaussian elimination over GF(2) for finding the the generating polynomial (which is not guaranteed to be minimal, unlike the result of the Berlekamp–Massey algorithm).

All signals shown in the table above consist of 7- or 21-bit long frames which are marked by LFSR-generated pseudo-random sequences:

Format (1): 7-bit frame delimited by F1
X X X X X X F1
1 2 3 4 5 6 7

Format (2): 21-bit frame delimited by F2, F3
X X X X X X X X X X X X X F2 X X X X X 1 F3
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

Format (3): 7-bit frame delimited by F4
X X X X X X F4
1 2 3 4 5 6 7

The pseudo-random sequences F1, F2, F3, F4 are generated the following polynomials:

sequence polynomial period recursion
F1 P1=1+x28+x31 231-1 F1(t) = F1(t-3)+F1(t-31) mod 2
F2 P2=1+x+x6 26-1 F2(t) = F2(t-5)+F2(t-6) mod 2
F3 P3=1+x+x7 27-1 F3(t) = F3(t-6)+F3(t-7) mod 2
F4=F1 P4=(1+x)P1 231-1 F4(t) = F4(t-1)+F4(t-3)+F4(t-4)+F4(t-31)+F4(t-32) mod 2

For format (2) the pseudo-random sequences could have been found by autocorrelation as they are short, whereas for the other formats the length of the pseudo-random sequence is 231-1, i.e., at 50/7 baud the sequences repeats after about 3480 days only.

Format (2) which can be easily identified as a peak at position 21 in the bit stream autocorrelation is also described, e.g., here and here.